CVE-2026-82079

Potential Leakage of Nintendo Switch System Information Through a Proximity-Based Remote Attack

No known exploitation. EPSS puts it in the 15th percentile. A vendor fix is available.

CVSS 3.18.4High EPSS percentile15th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-10Updated 2026-09-11Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

On each Nintendo Switch, open System Settings and check the current system version.
Update any console below 23.0.0 using System Update.
Until updated, avoid using affected wireless features near untrusted people and keep the console out of wireless range of strangers.

Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A stack-based buffer overflow vulnerability in the Nintendo Switch local wireless networking functionality may allow an attacker within wireless range to execute arbitrary code using return-oriented programming (ROP) through crafted network traffic. This issue affects Nintendo Switch: before 23.0.0.

In plain language

Written by AI from the record

Nintendo Switch consoles before 23.0.0 need attention because someone nearby may be able to take control without your help.

A stack-based buffer overflow in Nintendo Switch local wireless networking can enable unauthenticated arbitrary code execution through crafted nearby wireless traffic.

If you're affected

Console takeover
Saved-data exposure
Service disruption
Malicious software execution

What is it

This is a flaw in the console’s nearby wireless communications that can let a person close to the device send harmful data. It is like a nearby stranger finding a way to force open a service door and take control of the building rather than simply looking through a window.

Who is affected

This matters to you if you use or run a Nintendo Switch, including consoles used for business entertainment, events, customer areas, or staff use. No account sign-in or action from the person using the console is needed; it is only a risk when an attacker is within wireless range of the device.

How urgent is it

A nearby attacker can attempt to take control of the console without a login or user action, so this is a red-priority update. There is no confirmed public exploitation report or public exploit code, but update affected consoles as soon as practical because the potential impact is full device control.

What to do — in detail

Confirm exposure by checking each console’s installed system version in System Settings. Upgrade all affected Nintendo Switch consoles to 23.0.0 through the vendor’s System Update process; no separate version branches or compatibility-breaking changes are identified in the findings.

If updating is delayed, reduce exposure by keeping consoles away from untrusted people within wireless range and avoiding the affected nearby wireless use cases, including “Send to Smartphone” in Album and kart use in Mario Kart Live: Home Circuit, where practical. Watch for unexpected crashes or abnormal behavior during nearby wireless use, and preserve relevant console details for support if they occur.

CISA has not added this CVE to its Known Exploited Vulnerabilities catalog, so there is no CISA remediation due date listed.

Technical context

CVE-2026-82079 is rated CVSS 8.4 (High). The reported weakness is CWE-121, a stack-based buffer overflow in local wireless networking; crafted traffic from an attacker within wireless range may cause a crash or arbitrary code execution, with the technical description noting return-oriented programming. No authentication or user interaction is required, while default reachability is not known. CISA KEV does not list this CVE, no clear dated report confirms exploitation in the wild, and no public exploit code is on record. EPSS estimates a 0.2% likelihood (5th percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS15th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 15th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

15 events over 1 day, from the signal feeds we watch.

2026-09-11Patch availablepatch available, workaround available, workaround available, record updated, record updated
2026-09-10Patch availablepatch available, workaround available, workaround available, published, weakness classified, att&ck mapped, record updated, record updated

Affected products

Nintendocommercial · JP
- Nintendo SwitchEmbeddedConsumer Software / gaming

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.4 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable